Privacy notice
This notice explains what personal data we process when you visit the website, ask to join the pilot, use the customer area or receive updates for the NavuTron app (Article 13 of Regulation (EU) 2016/679, "GDPR").
1. Who the controller is
The controller is the sole proprietorship KURAMALAB DI MARRAZZO ANDREA MICHEL, registered at Via Cassiodoro 11, 88021 Borgia (CZ), Italy.
VAT no. 03634220796, REA no. CZ‑231090.
For any question about your data, write to info@navutron.com.
We have not appointed a data protection officer (DPO): it is not required for this activity.
2. What data we process and why
For each activity you will find the data, the purpose, the legal basis and how long we keep it.
Visiting the website
- Data: IP address, requested page, date and time, browser type, recorded by the web server.
- Why: to run the website and protect it from abuse and attacks.
- Legal basis: our legitimate interest in the security of the service (Art. 6(1)(f) and Recital 49 GDPR).
- How long: 30 days.
Website security log
- Data: events such as sign-ins, requested sign-in links and errors. IP addresses and emails are not written in clear: they are replaced by a code derived with a secret key (hash), used only to recognise repeated attempts.
- Why: to detect unauthorised access and abuse, and to fix errors.
- Legal basis: our legitimate interest in the security of the service (Art. 6(1)(f) GDPR).
- How long: 14 days.
Pilot access request
- Data: full name, email, organisation (optional), how you will use NavuTron, reply language, date and version of the Terms you accept.
- Why: to assess your request and reply. A person assesses every request.
- Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR).
- How long: request never confirmed: 7 days. Request confirmed but not yet decided: 6 months after confirmation. Request not approved: 6 months after our reply. Request approved: as for the customer area, because it proves you accepted the Terms.
Customer area and licences
- Data: email, name, organisation, language, status of your account, sign-in dates, notes we write about our relationship with you, licences (name, plan, dates, latest app version used). We keep the licence key only as a hash, plus its last group of characters so you can recognise it.
- Why: to give you access to the area, the installer and updates, and to manage licences, expiry dates and revocations.
- Legal basis: performance of the Terms (Art. 6(1)(b) GDPR).
- How long: as long as you have a valid licence, then 12 months. The hash of a revoked or replaced key is deleted after 30 days.
Signing in to the customer area
- Data: with the email link, a single-use code that we keep only as a hash. With "Sign in with Google", when it is available in the customer area, Google sends us your email address, whether it is verified, your name and an identifier of your Google account. We store only the identifier, to recognise you next time; the name is used only to prefill the pilot form, where you can change it. We do not receive your photo. For the admin panel, reserved for the controller, Google sends only the email.
- Why: to check that it is you before opening the area.
- Legal basis: performance of the Terms (Art. 6(1)(b)) and our legitimate interest in secure sign-in (Art. 6(1)(f) GDPR).
- How long: the link code is deleted within 24 hours of expiry. The Google identifier stays as long as your customer account; it is deleted earlier if you ask us to unlink Google or if we change your account email.
Service emails
- Data: email, name, language.
- Why: confirmations, outcome of the request, sign-in links, notices about licences, updates and security, end of the pilot. We send no marketing emails.
- Legal basis: performance of the Terms and pre-contractual steps (Art. 6(1)(b) GDPR).
- How long: as for the request or customer area the email refers to.
Update checks and downloads
- Data: on each check the app sends the licence key and the installed version, and the server sees the IP address. For each licence we keep only the date and version of the latest check, overwritten each time. The update and download log records outcome, version and licence name, with no IP address.
- Why: to tell you whether a new version exists, know which versions are in use so we can warn users of a faulty one, and block revoked keys or keys used by others.
- Legal basis: performance of the Terms (Art. 6(1)(b)) and our legitimate interest in the security of the service (Art. 6(1)(f) GDPR).
- How long: date and version of the latest check: as for the customer area. Log: 30 days. IP address: only in the web server logs, 30 days.
Emails you send us
- Data: your email address and what you write.
- Why: to reply to you.
- Legal basis: pre-contractual steps or performance of the Terms, if the email is about the pilot or a licence (Art. 6(1)(b)); otherwise our legitimate interest in replying (Art. 6(1)(f)). For requests about your rights, our legal obligation (Art. 6(1)(c) and Art. 12 GDPR).
- How long: as long as needed to handle the request. Requests about your rights and our replies: 2 years after the reply.
The required fields of the pilot form are needed to assess your request: without them we cannot reply. Organisation is optional.
We take no decisions based solely on automated processing.
4. Who processes data on our behalf
The website and its data are on a server owned by the controller, with no hosting provider. These processors handle data on our behalf:
- Cloudflare, Inc., which protects and delivers the website and forwards emails sent to info@navutron.com to our mailbox (Email Routing), under its data processing addendum. Data may pass through the United States: Cloudflare participates in the EU-U.S. Data Privacy Framework (adequacy decision, Art. 45 GDPR) and the addendum provides standard contractual clauses as a fallback (Art. 46 GDPR).
- Brevo (Sendinblue SAS, France), which sends the service emails, under the data processing agreement that is part of its general terms. Brevo counts how many emails are opened and how many links are clicked: it does so anonymously, without linking the count to your address, and this feature cannot be turned off.
- Only if you choose "Sign in with Google": Google checks your account and is the source of the data described above (Art. 14 GDPR). For this step Google acts as an independent controller, under its own privacy policy.
Emails you send to info@navutron.com are forwarded by Cloudflare to a personal Gmail mailbox of the controller. Google keeps them on its servers, including in the United States, under the Gmail terms for individuals: there is no specific data processing agreement with Google.
We do not sell your data or disclose it to anyone else, except where the law requires it.
5. Your rights
You can ask for access to your data, rectification, erasure, restriction and portability, and object to processing based on legitimate interest (Articles 15-21 GDPR).
To exercise them, write to info@navutron.com.
We reply within 14 days; the law allows at most one month (Art. 12(3) GDPR).
If you ask for erasure while you take part in the pilot or hold a licence, we also close your access and revoke your key.
You can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or with the supervisory authority of the EU country where you live or work (Art. 77 GDPR). The Authority's website: garanteprivacy.it
6. The NavuTron app
This notice does not cover what you do inside the app, which runs on your computer and keeps its data there. Update checks are described above. The agents you use with NavuTron, such as Claude Code or Codex, connect to their providers' services, which process data under their own privacy notices.
7. Changes
Each version of this notice has a date and a number, shown at the top of the page. If it changes materially, we will email pilot participants and customers before the change applies.
The rules of the pilot and of the customer area are in the Terms.